ClawHub
Back to skill

Security audit

AgentWallex Payment

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AgentWallex payment helper, but it handles payment credentials and can initiate crypto transfers with some under-scoped safety controls.

Review this before installing. Use sandbox keys first, avoid pasting production payment credentials into chat unless you accept that exposure model, verify the API base URL is an official AgentWallex HTTPS endpoint before any request, and require explicit review of recipient address, chain, token, and amount before transfers.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:140
Finding

Unrestricted API Base URL Can Expose Payment API Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:140-152 and authenticated request examples at SKILL.md:206-208, 243-245, 283-285, 308-310, 338-340, 375-377, 400-402, 422-424, 430-432, 448-450, 458-460, 475-477, and 488-495
Vulnerability Type: Credential disclosure through an unrestricted API endpoint
Risk Level: High

Vulnerable Code

bash
| **Production** | `$AGENTWALLEX_BASE_URL` | Live environment. Use production API keys (`awx_sk_live_*`). |

# Set the base URL (default: sandbox)
export AGENTWALLEX_BASE_URL="https://api-sandbox.agentwallex.com/api/v1"

Authenticated requests then transmit the API key to that environment-controlled URL:

bash
curl -s -X POST \
  "$AGENTWALLEX_BASE_URL/agents" \
  -H "X-API-Key: $AGENTWALLEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "payment-bot",
    "chain": "ethereum",
    "agent_description": "Handles outbound payments"
  }' | jq

The same pattern is used by balance, deposit, transfer, transaction-status, and transaction-list requests.

Technical Analysis

The skill documentation directs authenticated requests to a base URL obtained from the mutable AGENTWALLEX_BASE_URL environment variable. It does not require the destination to use HTTPS, verify that the destination hostname belongs to AgentWallex, or enforce an allowlist of trusted sandbox and production origins.

Because curl attaches AGENTWALLEX_API_KEY as an X-API-Key header, anyone able to influence the environment variable can redirect a documented request to an attacker-controlled endpoint. Merely setting a trusted default does not prevent the variable from being inherited, overwritten, or poisoned before the workflow runs.

This is particularly sensitive because the documented production keys begin with awx_sk_live_*, and the skill supports administrative and financial operations.

Attack Path

  1. An attacker, malicious wrapper, compromised shell profi ...[truncated 1160 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the unrestricted environment-controlled endpoint with explicit, hardcoded trusted origins for sandbox and production.
  2. Represent environment selection as a strict enumeration such as sandbox or production, then map it internally to the corresponding trusted URL.
  3. Before attaching credentials, parse and validate the URL:
    • Require the https scheme.
    • Require an exact approved hostname.
    • Reject embedded credentials, unexpected ports, malformed URLs, redirects to untrusted hosts, and hostname-suffix tricks.
  4. Configure curl to reject insecure transport and unsafe redirection. Avoid forwarding authentication headers across origins.
  5. Apply least-privilege API scopes, especially separating read-only administration from transfer authority.
  6. Rotate any key suspected of having been used while the base URL was untrusted.
  7. Add runtime tests verifying that credentials are never sent to HTTP endpoints, arbitrary hosts, or redirect destinations outside the approved allowlist.
  8. Document the exact trusted production endpoint rather than instructing users to provide an arbitrary URL.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: agentwallex-openclaw
description: Create and manage AI agents, send USDC/USDT payments, check balances across Ethereum, BSC, and Tron
homepage: https://agentwallex.com
emoji: 💳
metadata: {"openclaw": {"requires": {"bins": ["curl", "jq"], "configPaths": ["~/.openclaw/agentwallex/config.json"]}, "zeroConfig": false, "disableModelInvocation": false, "humanConfirmation": {"required": true, "actions": ["transfer", "pay"]}}}
---

# AgentWallex Payment Skill

## What It Does

The AgentWallex Payment skill gives AI agents core capabilities for managing agents and crypto payments:

- **Zero-config setup** — Set up AgentWallex through conversation.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

To also remove locally stored credentials:

bash
rm -rf ~/.openclaw/agentwallex

Available Tools

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

To also remove locally stored credentials:

bash
rm -rf ~/.openclaw/agentwallex

Available Tools

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README explicitly tells users the agent will help create an API key and save credentials locally, but it does not warn that these are sensitive secrets or describe how they are stored and protected. In a skill that can initiate crypto payments, unclear secret-handling guidance increases the risk of credential leakage, misuse by other local tools, or accidental exposure through logs, chat history, or insecure local storage.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: agentwallex-openclaw
description: Create and manage AI agents, send USDC/USDT payments, check balances across Ethereum, BSC, and Tron
homepage: https://agentwallex.com
emoji: 💳
metadata: {"openclaw": {"requires": {"bins": ["curl", "jq"], "configPaths": ["~/.openclaw/agentwallex/config.json"]}, "zeroConfig": false, "disableModelInvocation": false, "humanConfirmation": {"required": true, "actions": ["transfer", "pay"]}}}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises outbound crypto payment capability without a clear, user-facing warning that blockchain transfers may involve real funds and can be irreversible once submitted. In a payments skill, omission of that warning increases the chance of accidental loss from mistaken addresses, amounts, or chain selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs users to paste API credentials back into the conversation and says they will be validated and stored locally, but it does not clearly warn that API keys are sensitive secrets that may be retained in chat history, logs, transcripts, or accessible to the hosting platform. This creates an avoidable credential-exposure risk because users may disclose production payment credentials through the LLM interface.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

Creates a new AI agent with its own wallet on the specified chain. Returns 201 Created.

bash
curl -s -X POST \
  "$AGENTWALLEX_BASE_URL/agents" \
  -H "X-API-Key: $AGENTWALLEX_API_KEY" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 458)May include surrounding context.

Creates a new AI agent with its own wallet on the specified chain. Returns 201 Created.

bash
curl -s -X POST \
  "$AGENTWALLEX_BASE_URL/agents" \
  -H "X-API-Key: $AGENTWALLEX_API_KEY" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

Returns a deposit address for funding the agent wallet. EVM chains (Ethereum, BSC) share the same address.

bash
curl -s -X POST \
  "$AGENTWALLEX_BASE_URL/agents/AGENT_ID/deposit" \
  -H "X-API-Key: $AGENTWALLEX_API_KEY" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This documented API call initiates a real outbound transfer of funds to an external blockchain address. In the context of an agent skill, any action that can move value off-platform is inherently high risk if triggered with incorrect parameters, insufficient validation, or weak confirmation controls.

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

Initiates a transfer from an agent's wallet.

bash
curl -s -X POST \
  "$AGENTWALLEX_BASE_URL/agents/AGENT_ID/transfer" \
  -H "X-API-Key: $AGENTWALLEX_API_KEY" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This workflow example shows a transfer execution path using live-style parameters after a balance check. Even though it is instructional, it normalizes a powerful outbound-payment action that could be misused by an agent or user error to send irreversible funds externally.

Content

Scanner excerpt · SKILL.md (reported line 430)May include surrounding context.

Step 2 — Transfer funds (only if balance is sufficient):

bash
TX=$(curl -s -X POST \
  "$AGENTWALLEX_BASE_URL/agents/AGENT_ID/transfer" \
  -H "X-API-Key: $AGENTWALLEX_API_KEY" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 475)May include surrounding context.

Step 2 — Get a deposit address for the new agent:

bash
DEPOSIT=$(curl -s -X POST \
  "$AGENTWALLEX_BASE_URL/agents/$AGENT_ID/deposit" \
  -H "X-API-Key: $AGENTWALLEX_API_KEY" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This example directly demonstrates sending USDC from an agent wallet to an external address. Because the skill operates in a financial context, such transfer capability materially increases the blast radius of mistakes, prompt abuse, or insufficient confirmation, making the action security-sensitive.

Content

Scanner excerpt · SKILL.md (reported line 493)May include surrounding context.

md
-H "X-API-Key: $AGENTWALLEX_API_KEY" | jq '.[0].available'

# Transfer USDC
curl -s -X POST \
  "$AGENTWALLEX_BASE_URL/agents/$AGENT_ID/transfer" \
  -H "X-API-Key: $AGENTWALLEX_API_KEY" \
  -H "Content-Type: application/json" \